Systems and methods for detecting a security breach in a computer system

Abstract

The present invention provides systems and methods for applying hard-real-time capabilities in software to software security. For example, the systems and methods of the present invention allow a programmer to attach a periodic integrity check to an application so that an attack on the application would need to succeed completely within a narrow and unpredictable time window in order to remain undetected.

Description

[0001]The present application claims the benefit of U.S. Provisional Patent Application No. 60 / 432,655, filed on Dec. 12, 2002, the entire contents of which are incorporated herein by this reference.BACKGROUND OF THE INVENTION[0002]1. Field of the Invention[0003]The present invention relates to systems and methods for detecting a security breach in a computer system.[0004]2. Discussion of the Background[0005]Standard methods for computer system security include passwords and other authorization tokens, use of encryption, and permission checking systems. In such standard methods, “security markers” (e.g., checksums, digital signatures, and permission levels) and “security properties” (e.g., an exact match between a data item that is supposed to be immutable and a hidden copy of that data item) can be used to validate the integrity of data and of the security system. However, all methods have flaws and costs. In practice, no security system is 100% effective.[0006]The “defense in dept...

AI Technical Summary

Benefits of technology

[0009]The present invention provides systems and methods for applying hard-real-time capabilities in software to software security. For example, the systems and methods of the present invention allow a programmer to attach a periodic integrity check to an application so that an attack on the application would need to succeed completely within a narrow and unpredictable time window in order to remain undetected.

Problems solved by technology

The security process will raise an alarm if it finds that the application code has been tampered with, if it finds that critical data structures do not have matching checksums, or if it detects that the application is not being scheduled at the required frequency.

If the challenge handler does not respond to the challenge within the predetermined time limit, then this is indication that the computer system may be compromised.

Images